KR20020072618A - Network based intrusion detection system - Google Patents

Abstract

PURPOSE: A network based IDS(Intrusion Detection System) is provided to enhance a packet catch performance by catching a small size packet in a high speed network without a loss and to fast and exactly detect the misuse and the abnormal activity in the network. CONSTITUTION: The system comprises an intrusion detect sensor(130) detecting the misuse through the pattern matching after collecting the packets by connecting to the network, and an intrusion detect server generating a normal profile for each source by receiving the packets collected by the intrusion detect sensor and detecting the abnormal activity. The intrusion sensor includes a packet collecting and distributing part collecting and distributing the packet from the network, a pattern matching part detecting the intrusion by comparing the packet transferred from the packet collecting and distributing part with the previously stored pattern, a packet filtering and dissembling part dissembling the packet from the pattern matching part, and a distributing part for transferring the data from the packet filtering and dissembling part to the intrusion detect server.

Description

Network based intrusion detection system

The present invention relates to an intrusion detection system (IDS) for monitoring abnormal behavior, misuse, and abuse on a network. More particularly, the present invention relates to network-based intrusion, which improves the capture performance of a packet transmitted through a network. It relates to a network based IDS.

Recently, with the rapid spread of personal computers and the use of the Internet, various e-businesses, such as e-commerce, e-money, and e-mail, have been developed as basic means of living. The dysfunction of informatization such as infringement has emerged as a social problem.

In order to solve this problem, virtual private networks (VPNs), firewalls, and intrusion detection systems (IDS) have been widely studied as computer network security technologies. The well-known firewall is a technology for protecting the internal network from the outside, and it is a general term for a policy to protect internal information assets from external intrusions and to block harmful information from outside and the hardware and software supporting them. . Therefore, the firewall usually exists at the boundary between the Internet and the internal network to control the flow of information, and there is a problem of delaying the speed of traffic by blocking the flow of network traffic. Intrusion Detection System (IDS) is a technology that detects intrusion by real-time monitoring of network or system usage by using intrusion pattern database and expert system located in internal network or host. Therefore, the firewall and intrusion detection system can minimize damage even if the intrusion prevention fails, and respond appropriately to hacking even in the absence of the network administrator.

However, the conventional intrusion detection system (IDS) is implemented in software, there is a problem that the detection performance is poor because it does not catch all the packets transmitted through the network. In particular, according to the conventional method, when the packet size is small, the packet capture performance is known to drop to about 30% or less.

An object of the present invention is to provide a network-based intrusion detection system that can significantly improve the packet capture performance in a high-speed network to solve the above problems.

1 is a view illustrating a intrusion detection system according to the present invention;

2 is a block diagram showing the configuration of an intrusion detection system according to the present invention.

* Explanation of symbols for main parts of the drawings

100: Internet 110: firewall system

120: internal network 121-124: host system

130: Intrusion Detection System

200: intrusion detection sensor 210: packet collection and distribution unit

220: first buffering unit 230: pattern matching unit

240: packet filtering and decomposition unit 250: second buffering unit

260: distribution unit 270: IDS network

280-1 to 280-n: Intrusion Detection Server

In order to achieve the above object, the present invention provides a network-based intrusion detection system that detects an intrusion after collecting a packet connected to a network, detecting the misuse through pattern matching after collecting the packet connected to the network Intrusion detection sensor; And an intrusion detection server that receives the packets collected from the intrusion detection sensor, generates a normal profile for each source, and detects abnormal behavior.

The intrusion detection sensor according to the present invention comprises: a packet collecting and distribution unit for collecting and distributing packets from a network; A pattern matching unit which stores a pattern in advance and detects an intrusion by comparing with a packet transmitted from the packet collection and distribution unit; A packet filtering and decomposing unit for decomposing a packet transmitted from the pattern matching unit; And a distribution unit for transmitting the data transmitted from the packet filtering and decomposition unit to the intrusion detection server.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a view for explaining the intrusion detection system according to the present invention. Referring to FIG. 1, an internal network 120 is connected to the Internet 100 through a firewall 110, and a plurality of hosts 121 ˜ 124 are connected to the internal network 120 by a LAN. An intrusion detection system 130 for monitoring packets transmitted at high speed is connected to the internal network 130. In the embodiment of the present invention, the internal network is a 100 Mbps Fast Ethernet network, and in general, a plurality of hosts, terminals, and network resources are connected to the Ethernet.

The Internet 100, which is characterized by openness, transmits data through packets according to the TCP / IP protocol, and packets transmitted to the internal network through the Internet 100 are filtered through the primary firewall 110 and then internal network ( All packets entering 120 and delivered from internal network 120 are monitored by network-based intrusion detection system 130 according to the present invention.

In general, the intrusion detection system has four components: data collection, data processing and contraction, intrusion analysis and detection, reporting and response. The data collection step is an audit data collection step that collects data generated from a detection target such as a packet used for computer communication provided by the intrusion system to the target system. In the host base, its own log that records the usage history of the host is recorded. Because files are present, relevant data is collected from these files, and network-based, it catches and collects all packets passing through the network. The collected series of audit data is converted into meaningful information to enable intrusion determination in the data processing and abbreviation stages, and the analysis and intrusion detection stages are analyzed to determine intrusions.

Intrusion detection stages are classified into abnormal behavior detection technology and misuse detection technology according to whether they aim to detect abnormal use of the system or intrusion detection using a vulnerability of a system or a bug of an application program. In the reporting and response stage, if the intrusion detection system determines that the system is invasive, if it is determined to be intrusion, the system automatically takes an appropriate response or reports the intrusion to the security administrator to take an action by the security administrator.

Such intrusion detection system has classification method based on intrusion model and data acquisition location for intrusion detection, that is, classification method based on data source. When classifying based on intrusion model, abnormal behavior detection method and misuse detection method are classified. Separated by. The classification method based on the data source is based on the host base that uses audit data generated from a single host for intrusion detection, the multi host base which collects audit data generated from several hosts connected to the network, and detects the intrusion. Packet data can be collected and classified on a network basis to detect network intrusions.

Here, abuse intrusion refers to a known attack type that can invade a system through a weakness of a system or application software. In the misuse detection method, all such known intrusions are set in the form of patterns or signatures, and then the intrusion of the same method is detected through predetermined patterns or signatures. As such, the misuse intrusion detection method is a method of detecting a pattern or a signature of existing intrusion techniques, and thus, how well a pattern or a signature of the existing intrusion techniques is generated is very important. At this time, the generated patterns or signatures should be made to distinguish only the intrusion exactly, otherwise false positive and false negative may occur. While this method can detect many known intrusions, it is not possible to detect intrusions using unknown methods. Intrusion detection methods are classified into expert system, signature analysis, Petrinet, state transition analysis, and model-based intrusion detection methods according to how well-known intrusion information is composed.

An abnormal behavior detection method detects a deviation from a normal behavior of a system or a user. When a normal behavior is collected through various methods from audit data that records the normal behavior of a system or a user, the behavior of the system that is performed is out of the normal behavior. Raises a warning. In other words, the abnormal behavior detection method is regarded as an intrusion if a behavior that has not been learned before occurs in the system. A typical method for detecting such abnormal behavior is a statistical approach, which observes the behavior of a process executed by a user or a system, and creates a profile for each behavior. At this time, the characteristics of the profile constituting action are the login and logout times of the session, the usage of processor, memory, and disk resources during the session. After configuring the normal behavior profile, it is determined whether the behavior of the user and the system deviates from the predetermined normal behavior. In addition, there are expert systems, neural networks, predictable pattern generation methods, and user-centered approaches to detect abnormal behavior.

On the other hand, network-based intrusion detection system (NIDS: Network-based IDS) mainly detects intrusion by analyzing network packets, SNMP MIB, application log, and the like. Since NIDS aims to protect network infrastructure by detecting network-based attacks, in most cases, as with host-based intrusion detection systems, attacks from specific hosts cannot be detected or detailed records are left. NIDS also needs to detect intrusions through real-time analysis of all traffic, which needs to improve packet catching performance in real time to analyze large volumes of traffic in proportion to network speeds.

In addition, most network-based intrusion detection systems (NIDS) collect network packets through a network access card (NIC) to perform passive analysis, which makes installation easy without any overhead on existing network resources. Installing only on an access point can handle the entire network. In addition, unlike host-based, network-based monitors are not actively involved in protocols, and attackers can easily monitor intrusions without being exposed to attackers as they only collect and analyze transmitted packets.

2 is a block diagram showing the configuration of a network-based intrusion detection system according to the present invention.

The network-based intrusion detection system according to the present invention is an intrusion detection sensor (IDS sensor) 200 for capturing all packets of an internal network connected to the internal network 120 and an internal network to which packets are transmitted by connecting ordinary hosts. ) And an IDS server 280 that analyzes the packets detected by the IDS sensor 200 to determine and take an intrusion. In particular, in the embodiment of the present invention, the IDS server 280 is connected to the N IDS servers 280-1 to 280-n in a load sharing manner to form an IDS network 270. By doing so, it is possible to improve the performance of intrusion analysis. Therefore, the packets collected from the intrusion detection sensor 200 are properly distributed to N IDS servers 280-1 to 280-n and transmitted. In this case, packets transmitted to each IDS server may be delivered after packet filtering.

2, the intrusion detection sensor 200 includes a packet collecting and distributing unit 210, a first buffering unit 220, a pattern matching unit 230, a packet filtering and decomposition unit 240, and a second buffering unit. The unit 250 and the distribution unit 260 process a function of largely detecting a packet, a function of analyzing a received packet, and a function of distributing a packet to the distributed IDS network 270 by a load steering method.

The packet collection and distribution unit 210 is implemented as an MPC860 Ethernet chip 212 having no IP, collects and distributes packets of the internal network 120 to the first buffering unit 220, and the first buffering unit 220. Is implemented as a plurality of dual-port RAM (222). The pattern matching unit 230 detects misuse intrusion in hardware by comparing the packets output by the first buffering unit 220 with a pre-built pattern. The pattern matching unit 230 is implemented with a plurality of field programmable gate arrays (FPGA) 232.

The packet filtering and decomposing unit 240 is implemented by the MC68302 microcomputer 242 and decomposes the packet and distributes the packet in consideration of the load condition. The second buffering unit 250 is implemented as a dual-port RAM (252) to temporarily store the decomposed packet to be delivered to the IDS server 280, the distribution unit 250 to the MPC860 Ethernet chip 262 Implemented to transmit the output of the second buffering unit 250 to the IDS server (280-1 ~ 280-n) through the IDS network 270.

Each IDS server 280-1 to 280-n analyzes the delivered packet and generates a normal profile for each IP to detect abnormal behavior. If an intrusion is detected by pattern matching and packet analysis, the security manager (network manager) is notified.

As described above, since the network-based intrusion detection system according to the present invention uses hardware-based pattern matching, it is possible to catch small packets in a high-speed network without losing them, thereby improving packet capture performance. It can improve to close to%, which has the advantage of detecting misuse and abnormal behavior in the network quickly and accurately. In particular, it is connected to the internal network without an IP and passively catches and analyzes all packets. Therefore, there is no risk of exposure to intruders. If an intrusion is detected, the IDS server delivers it to the network administrator via e-mail or communication means. In addition, there is an advantage to respond appropriately.

Claims (7)

In the network-based intrusion detection system that detects an intrusion after connecting to the network to collect packets, An intrusion detection sensor connected to the network to collect packets and detect misuse through pattern matching; And And an intrusion detection server configured to receive packets collected from the intrusion detection sensor, generate a normal profile for each source, and detect abnormal behavior. According to claim 1, wherein the intrusion detection sensor A packet collecting and distribution unit for collecting and distributing packets from the network; A pattern matching unit which stores a pattern in advance and detects an intrusion by comparing with a packet transmitted from the packet collection and distribution unit; A packet filtering and decomposing unit for decomposing a packet transmitted from the pattern matching unit; And a distribution unit for transferring the data transmitted from the packet filtering and decomposition unit to the intrusion detection server. The network-based intrusion detection system of claim 2, wherein the pattern matching unit is implemented as an FPGA. The method of claim 2, wherein the intrusion detection sensor And a first buffering unit for temporarily storing the output of the packet collection and distribution unit. The method of claim 2, wherein the intrusion detection sensor And a second buffering unit for temporarily storing the output of the packet filtering and decomposition unit. The network-based intrusion detection system of claim 1, wherein the intrusion detection server is implemented as a load balancing network connected through Ethernet. The network-based intrusion detection system of claim 1, wherein the intrusion detection server stores the contents of the intrusion in a database and notifies the network administrator.